IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Currently Amended) A method for identifying network traffic, comprising: 

converting traffic data into a wave vector; 

comparing the wave vector with a wave template; 

determining whether the wave vector is substantially similar to the wave 

template; and 

in the event it is determined that the wave vector is substantially similar to 
the wave template, identifying the traffic data as being associated with an application or 
network protocol with which the wave template is associated; 

wherein the wave vector comprises numerical representations of the traffic 
data obtained by applying a transformation to a data sequence in the traffic data. 

2. (Original) A method for identifying network traffic as recited in Claim 1 , wherein 
converting the traffic data into a wave vector comprises performing a transformation on the 
traffic data. 

3. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises performing a transformation on the 
traffic data and zero-padding the traffic data. 

4. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises mapping the traffic data to a plurality of 
values. 

5. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises mapping the traffic data to a plurality of 
American Standard Code for Information Interchange (ASCII) codes. 

6. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
comparing the wave vector with a wave template comprises determining a difference between 
the wave vector and the wave template and computing a score based on the difference. 
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7. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
performing a Fourier Transform. 

8. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
determining whether the comparison meets a predetermined criteria. 

9. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
determining a score based on the comparison. 

10. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template comprises 
determining a score based on the comparison and determining whether the score meets a 
threshold. 

1 1 . (Original) A method for identifying network traffic as recited in Claim 1 , wherein the 
wave template is a first wave template and the method further comprises determining whether 
the wave vector is substantially similar to a second wave template. 

12. (Currently Amended) A method for identifying network traffic as recited in Claim 1 1, 
wherein determining whether the wave vector is substantially similar to [[a]] the second wave 
template comprises: 

computing a first score based on the comparison of the wave vector with 
the first wave template; 

comparing the wave vector with the second wave template; 

computing a second score based on the comparison of the wave vector 
with the second wave template; and 

comparing the first score and the second score. 

13. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
traffic data includes information extracted from a data packet. 

14. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
traffic data includes information extracted from a plurality of data packets. 

15. (Canceled) A method for identifying network traffic as recited in Claim 1, in the event 
that the wave vector is substantially similar to the wave template, further comprising determining 
that a protocol associated with the wave template also is associated with the traffic data. 



Application Serial No. 10/677,748 
Attorney Docket No. SYMAP034 



3 



16. (Currently Amended) A method for identifying network traffic as recited in Claim [[1 5]] 
i further comprising returning an identifier indicating the protocol. 

17. (Canceled) 

1 8. (Original) A method for identifying network traffic as recited in Claim 1 , in the event that 
the wave vector is substantially similar to the wave template, further comprising assigning a 
score to a match. 

19. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
wave template is created by: 

collecting sample traffic; 

transforming the sample traffic to a sample wave vector; and 
performing a computation on the sample wave vector. 

20. (Canceled) 

21 . (Currently Amended) A system for identifying network traffic, comprising: 

a processor configured to convert traffic data into a wave vector; compare 
the wave vector with a wave template; and determine whether the wave vector is 
substantially similar to the wave template ; and in the event it is determined that the wave 
vector is substantially similar to the wave template, identify the traffic data as being 
associated with an application or network protocol with which the wave template is 
associated ; and 

a memory coupled with the processor, wherein the memory is configured 
to provide the processor with instructions; 

wherein the wave vector comprises numerical representations of the traffic 
data obtained by applying a transformation to a data sequence in the traffic data. 

22. (Currently Amended) A computer program product for identifying network traffic, the 
computer program product being embodied in a computer readable medium and comprising 
computer instructions for: 

converting traffic data into a wave vector; 

comparing the wave vector with a wave template; 

determining whether the wave vector is substantially similar to the wave 

template; and 
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in the event it is determined that the wave vector is substantially similar to 
the wave template, identifying the traffic data as being associated with an application or 
network protocol with which the wave template is associated; 

wherein the wave vector comprises numerical representations of the traffic 
data obtained by applying a transformation to a data sequence in the traffic data. 
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